@fedify/vocab-runtime 2.4.5-dev.2462 → 2.4.6-dev.2628

package/dist/tests/pinners/testdata/node-child.cjs

@@ -0,0 +1,135 @@
+const require_rolldown_runtime = require("../../rolldown-runtime-emK7D4bc.cjs");
+const require_pin_grant = require("../../pin-grant-CPrpk1l4.cjs");
+const require_node = require("../../node-BvS3AhZ2.cjs");
+let node_process = require("node:process");
+node_process = require_rolldown_runtime.__toESM(node_process, 1);
+//#region src/pinners/testdata/node-child.ts
+/**
+* A child process for the regression tests of the Node.js pinner in
+* *../node.test.ts* that depend on the environment at startup: Node.js reads
+* proxy environment variables (with `NODE_USE_ENV_PROXY=1`) and
+* `NODE_EXTRA_CA_CERTS` only at startup.
+*
+* Node.js cannot run TypeScript sources without flags before 22.6.0, so
+* *../../../tsdown.config.ts* compiles this script into
+* *dist/tests/pinners/testdata/node-child.mjs*, which the tests run.  It has
+* no top-level `await`, so that it can be compiled to CommonJS as well.
+*
+* Usage:
+*
+*  -  `node node-child.mjs proxy <http-port> <https-port>`: requests
+*     `http://pinned-host.invalid:<http-port>/pinned` and
+*     `https://pinned-host.invalid:<https-port>/pinned` through a pinner
+*     that allows loopback addresses, with both pinned to 127.0.0.1, and then
+*     `http://127.0.0.1:<http-port>/control` with the global `fetch()` as
+*     a control.
+*  -  `node node-child.mjs tls <https-port>`: requests
+*     `https://<hostname>:<https-port>/<case>` through a pinner that allows
+*     loopback addresses, with every hostname pinned to 127.0.0.1, in the same
+*     order as *tls-child.ts* does for Bun.
+*
+* It prints the results as a JSON line.
+* @module
+*/
+const loopback = [{
+	address: "127.0.0.1",
+	family: 4
+}];
+/**
+* Describes an error by its code, or by the code of its cause, since
+* the `fetch()` of Node.js rejects with a `TypeError` caused by the actual
+* error.
+*/
+function describeError(error) {
+	for (let e = error; typeof e === "object" && e !== null;) {
+		const { code, cause } = e;
+		if (typeof code === "string") return code;
+		e = cause;
+	}
+	return String(error);
+}
+async function attempt(fn) {
+	try {
+		const response = await fn();
+		return {
+			status: response.status,
+			body: await response.text()
+		};
+	} catch (error) {
+		return { error: describeError(error) };
+	}
+}
+function fetchPinned(pinner, url, withSignals = false) {
+	const grant = require_pin_grant.issuePinGrant(url, loopback);
+	return attempt(() => withSignals ? pinner.fetch(grant, new Request(url, { signal: new AbortController().signal }), new AbortController().signal) : pinner.fetch(grant, new Request(url)));
+}
+async function proxy(pinner, httpPort, httpsPort) {
+	const http = await fetchPinned(pinner, new URL(`http://pinned-host.invalid:${httpPort}/pinned`));
+	const https = await fetchPinned(pinner, new URL(`https://pinned-host.invalid:${httpsPort}/pinned`));
+	const control = await attempt(() => fetch(`http://127.0.0.1:${httpPort}/control`, {
+		redirect: "manual",
+		signal: AbortSignal.timeout(1e4)
+	}));
+	return {
+		version: node_process.default.version,
+		http,
+		https,
+		control
+	};
+}
+async function tls(pinner, port) {
+	const results = [];
+	for (const [name, hostname, withSignals] of [
+		[
+			"pinned",
+			"pinned-host.invalid",
+			false
+		],
+		[
+			"unlisted",
+			"unlisted-host.invalid",
+			false
+		],
+		[
+			"unlisted-again",
+			"unlisted-host.invalid",
+			false
+		],
+		[
+			"alternate",
+			"alternate-host.invalid",
+			false
+		],
+		[
+			"signals",
+			"pinned-host.invalid",
+			true
+		]
+	]) {
+		const url = new URL(`https://${hostname}:${port}/${name}`);
+		results.push({
+			case: name,
+			...await fetchPinned(pinner, url, withSignals)
+		});
+	}
+	return {
+		version: node_process.default.version,
+		results
+	};
+}
+async function main() {
+	const [mode, ...ports] = node_process.default.argv.slice(2);
+	const [first, second] = ports.map(Number);
+	const pinner = require_node.createNodePinner({
+		verifyAddress() {},
+		undici: await import("undici")
+	});
+	if (mode === "proxy" && Number.isInteger(first) && Number.isInteger(second)) return await proxy(pinner, first, second);
+	else if (mode === "tls" && Number.isInteger(first)) return await tls(pinner, first);
+	throw new TypeError("Usage: node-child.mjs proxy <http-port> <https-port> | node-child.mjs tls <https-port>");
+}
+main().then((output) => node_process.default.stdout.write(`${JSON.stringify(output)}\n`, () => node_process.default.exit(0)), (error) => {
+	console.error(error);
+	node_process.default.exit(1);
+});
+//#endregion

package/dist/tests/pinners/testdata/node-child.d.cts

@@ -0,0 +1 @@
+export { };

package/dist/tests/pinners/testdata/node-child.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/tests/pinners/testdata/node-child.mjs

@@ -0,0 +1,134 @@
+import { t as issuePinGrant } from "../../pin-grant-H5XhM1Xs.mjs";
+import { t as createNodePinner } from "../../node-Cg4pRuYy.mjs";
+import process from "node:process";
+//#region src/pinners/testdata/node-child.ts
+/**
+* A child process for the regression tests of the Node.js pinner in
+* *../node.test.ts* that depend on the environment at startup: Node.js reads
+* proxy environment variables (with `NODE_USE_ENV_PROXY=1`) and
+* `NODE_EXTRA_CA_CERTS` only at startup.
+*
+* Node.js cannot run TypeScript sources without flags before 22.6.0, so
+* *../../../tsdown.config.ts* compiles this script into
+* *dist/tests/pinners/testdata/node-child.mjs*, which the tests run.  It has
+* no top-level `await`, so that it can be compiled to CommonJS as well.
+*
+* Usage:
+*
+*  -  `node node-child.mjs proxy <http-port> <https-port>`: requests
+*     `http://pinned-host.invalid:<http-port>/pinned` and
+*     `https://pinned-host.invalid:<https-port>/pinned` through a pinner
+*     that allows loopback addresses, with both pinned to 127.0.0.1, and then
+*     `http://127.0.0.1:<http-port>/control` with the global `fetch()` as
+*     a control.
+*  -  `node node-child.mjs tls <https-port>`: requests
+*     `https://<hostname>:<https-port>/<case>` through a pinner that allows
+*     loopback addresses, with every hostname pinned to 127.0.0.1, in the same
+*     order as *tls-child.ts* does for Bun.
+*
+* It prints the results as a JSON line.
+* @module
+*/
+const loopback = [{
+	address: "127.0.0.1",
+	family: 4
+}];
+/**
+* Describes an error by its code, or by the code of its cause, since
+* the `fetch()` of Node.js rejects with a `TypeError` caused by the actual
+* error.
+*/
+function describeError(error) {
+	for (let e = error; typeof e === "object" && e !== null;) {
+		const { code, cause } = e;
+		if (typeof code === "string") return code;
+		e = cause;
+	}
+	return String(error);
+}
+async function attempt(fn) {
+	try {
+		const response = await fn();
+		return {
+			status: response.status,
+			body: await response.text()
+		};
+	} catch (error) {
+		return { error: describeError(error) };
+	}
+}
+function fetchPinned(pinner, url, withSignals = false) {
+	const grant = issuePinGrant(url, loopback);
+	return attempt(() => withSignals ? pinner.fetch(grant, new Request(url, { signal: new AbortController().signal }), new AbortController().signal) : pinner.fetch(grant, new Request(url)));
+}
+async function proxy(pinner, httpPort, httpsPort) {
+	const http = await fetchPinned(pinner, new URL(`http://pinned-host.invalid:${httpPort}/pinned`));
+	const https = await fetchPinned(pinner, new URL(`https://pinned-host.invalid:${httpsPort}/pinned`));
+	const control = await attempt(() => fetch(`http://127.0.0.1:${httpPort}/control`, {
+		redirect: "manual",
+		signal: AbortSignal.timeout(1e4)
+	}));
+	return {
+		version: process.version,
+		http,
+		https,
+		control
+	};
+}
+async function tls(pinner, port) {
+	const results = [];
+	for (const [name, hostname, withSignals] of [
+		[
+			"pinned",
+			"pinned-host.invalid",
+			false
+		],
+		[
+			"unlisted",
+			"unlisted-host.invalid",
+			false
+		],
+		[
+			"unlisted-again",
+			"unlisted-host.invalid",
+			false
+		],
+		[
+			"alternate",
+			"alternate-host.invalid",
+			false
+		],
+		[
+			"signals",
+			"pinned-host.invalid",
+			true
+		]
+	]) {
+		const url = new URL(`https://${hostname}:${port}/${name}`);
+		results.push({
+			case: name,
+			...await fetchPinned(pinner, url, withSignals)
+		});
+	}
+	return {
+		version: process.version,
+		results
+	};
+}
+async function main() {
+	const [mode, ...ports] = process.argv.slice(2);
+	const [first, second] = ports.map(Number);
+	const pinner = createNodePinner({
+		verifyAddress() {},
+		undici: await import("undici")
+	});
+	if (mode === "proxy" && Number.isInteger(first) && Number.isInteger(second)) return await proxy(pinner, first, second);
+	else if (mode === "tls" && Number.isInteger(first)) return await tls(pinner, first);
+	throw new TypeError("Usage: node-child.mjs proxy <http-port> <https-port> | node-child.mjs tls <https-port>");
+}
+main().then((output) => process.stdout.write(`${JSON.stringify(output)}\n`, () => process.exit(0)), (error) => {
+	console.error(error);
+	process.exit(1);
+});
+//#endregion
+export {};

package/dist/tests/pinners-CJi9ZkYs.cjs

@@ -0,0 +1,220 @@
+const require_pin_grant = require("./pin-grant-CPrpk1l4.cjs");
+const require_url = require("./url-Bdj-rTcC.cjs");
+const require_node = require("./node-BvS3AhZ2.cjs");
+let _logtape_logtape = require("@logtape/logtape");
+let node_net = require("node:net");
+//#region src/pinners/bun.ts
+const logger = (0, _logtape_logtape.getLogger)([
+	"fedify",
+	"runtime",
+	"fetch"
+]);
+/**
+* The first Bun version that honors `proxy: false` when proxy environment
+* variables are set at startup.  Earlier versions send pinned requests
+* through the proxy, with the validated IP address as the target.
+*/
+const PROXY_FALSE_MIN_VERSION = "1.4.3";
+const PROXY_VARIABLES = [
+	"HTTP_PROXY",
+	"http_proxy",
+	"HTTPS_PROXY",
+	"https_proxy",
+	"ALL_PROXY",
+	"all_proxy"
+];
+const FALLBACK_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ConnectionRefused",
+	"ECONNREFUSED",
+	"EHOSTUNREACH",
+	"ENETUNREACH",
+	"ETIMEDOUT"
+]);
+/**
+* Bun versions before 1.3.11 verify the server certificate against the `Host`
+* header, including a non-default port, instead of `tls.serverName`, so
+* pinned requests to HTTPS servers on non-default ports always fail the check
+* there.  A custom `checkServerIdentity` cannot stand in for it: these
+* versions send the whole request before a failing custom check aborts it
+* (and 1.3.10 even reuses the connection for the next request), so such
+* requests are refused instead.
+*/
+const HOST_HEADER_IDENTITY_RANGE = "<1.3.11";
+/**
+* Creates a pinner for Bun.  Every request is sent to an IP literal URL with
+* the original `Host` header, `tls.serverName` set to the original hostname
+* (so that the certificate is still verified against it), and `proxy: false`.
+*
+* GET and HEAD requests fall back to the next address on transport errors
+* raised before a response arrives.  Other methods use only the first
+* address, since a transport error does not guarantee that the request did
+* not reach the server, and retrying it could deliver an activity twice.
+* Together with the transport retries of `doubleKnock()`, a GET request is
+* attempted at most twice per address.  Note that Bun 1.4 also reports
+* a connection reset after the request was sent as a `TypeError`, so GET and
+* HEAD requests may be repeated against the next address in that case, which
+* is acceptable for these idempotent methods.
+*
+* Bun versions before 1.3.11 verify certificates against the `Host` header,
+* which includes a non-default port, and cannot safely check them against
+* the original hostname in any other way, so requests to HTTPS servers on
+* non-default ports fail there with a `TypeError` before connecting.
+*
+* Bun versions before 1.4.3 ignore `proxy: false` when proxy environment
+* variables are set, so requests go through the proxy with the validated IP
+* address as the target.  In that case a warning is logged once.
+* @param options The pinner options.
+* @returns The pinner.
+*/
+function createBunPinner({ verifyAddress }) {
+	let proxyWarningPending = ignoresProxyFalse() && hasProxyVariables();
+	return {
+		supports(url) {
+			return url.protocol === "http:" || url.protocol === "https:";
+		},
+		async fetch(grant, request, signal) {
+			const url = new URL(request.url);
+			const { hostname, addresses } = require_pin_grant.redeemPinGrant(grant, url);
+			if (proxyWarningPending) {
+				proxyWarningPending = false;
+				logger.warn("Bun {version} ignores proxy: false while proxy environment variables are set, so outbound requests go through the proxy instead of connecting directly to the validated addresses.  Upgrade to Bun {minVersion} or later, or unset the proxy environment variables; see {url}.", {
+					version: getBun()?.version,
+					minVersion: PROXY_FALSE_MIN_VERSION,
+					url: "https://fedify.dev/manual/deploy#bun-behind-an-http-proxy"
+				});
+			}
+			const fallback = request.method === "GET" || request.method === "HEAD";
+			const candidates = fallback ? addresses : addresses.slice(0, 1);
+			const body = request.body == null ? null : await request.arrayBuffer();
+			let lastError = /* @__PURE__ */ new TypeError(`No address to connect to for ${url.host}.`);
+			for (const address of candidates) {
+				throwIfAborted(signal, request.signal);
+				verifyAddress(address);
+				const headers = new Headers(request.headers);
+				headers.set("Host", url.host);
+				const init = {
+					method: request.method,
+					headers,
+					body,
+					redirect: "manual",
+					signal: signal == null || signal === request.signal ? request.signal : anySignal(signal, request.signal),
+					proxy: false
+				};
+				if (url.protocol === "https:") init.tls = getTlsOptions(url, hostname);
+				try {
+					return await fetch(toAddressUrl(url, address), init);
+				} catch (error) {
+					throwIfAborted(signal, request.signal);
+					if (!fallback || !isFallbackError(error)) throw error;
+					lastError = error;
+				}
+			}
+			throw lastError;
+		},
+		release() {}
+	};
+}
+function getTlsOptions(url, hostname) {
+	const bun = getBun();
+	if (url.port !== "" && bun != null && bun.semver.satisfies(bun.version, HOST_HEADER_IDENTITY_RANGE)) throw new TypeError(`Bun ${bun.version} cannot verify the certificate of ${url.host} when connecting to a validated address; upgrade to Bun 1.3.11 or later to fetch from HTTPS servers on non-default ports.`);
+	return (0, node_net.isIP)(hostname) === 0 ? { serverName: hostname } : {};
+}
+/**
+* Combines two signals without `AbortSignal.any()`, which Bun 1.1.0 lacks.
+*/
+function anySignal(a, b) {
+	if (a.aborted) return a;
+	if (b.aborted) return b;
+	const controller = new AbortController();
+	const abort = (event) => {
+		controller.abort(event.target.reason);
+		a.removeEventListener("abort", abort);
+		b.removeEventListener("abort", abort);
+	};
+	a.addEventListener("abort", abort);
+	b.addEventListener("abort", abort);
+	return controller.signal;
+}
+function toAddressUrl(url, address) {
+	const result = new URL(url);
+	result.hostname = address.family === 6 ? `[${address.address}]` : address.address;
+	return result;
+}
+function isFallbackError(error) {
+	if (error instanceof Error && error.name === "AbortError") return false;
+	if (error instanceof TypeError) return true;
+	const code = error?.code;
+	return typeof code === "string" && FALLBACK_ERROR_CODES.has(code);
+}
+function throwIfAborted(...signals) {
+	for (const signal of signals) signal?.throwIfAborted();
+}
+function getBun() {
+	return globalThis.Bun;
+}
+function ignoresProxyFalse() {
+	const bun = getBun();
+	if (bun == null) return false;
+	return !bun.semver.satisfies(bun.version, `>=${PROXY_FALSE_MIN_VERSION}`);
+}
+function hasProxyVariables() {
+	const env = globalThis.process?.env;
+	if (env == null) return false;
+	return PROXY_VARIABLES.some((name) => (env[name] ?? "") !== "");
+}
+//#endregion
+//#region src/pinners/mod.ts
+/**
+* Detects the current runtime.  Cloudflare Workers is checked first, since
+* `process` can exist there with `nodejs_compat`, and Deno and Bun before
+* Node.js, since both provide `process.versions.node`.
+* @returns The current runtime.
+*/
+function detectRuntime() {
+	const g = globalThis;
+	if (g.navigator?.userAgent === "Cloudflare-Workers") return "cfworkers";
+	if ("Deno" in globalThis) return "deno";
+	if ("Bun" in globalThis) return "bun";
+	if (g.process?.versions?.node != null) return "node";
+	return "other";
+}
+let runtimePinner;
+/**
+* Gets the production pinner of the current runtime, which rejects
+* non-public addresses right before connecting.  Deno and Cloudflare Workers
+* have no pinner.
+* @returns The pinner, or `null` if the runtime has none.
+*/
+function getRuntimePinner() {
+	runtimePinner ??= createRuntimePinner(detectRuntime());
+	return runtimePinner;
+}
+async function createRuntimePinner(runtime) {
+	switch (runtime) {
+		case "bun": return createBunPinner({ verifyAddress: require_url.assertPublicAddress });
+		case "node": return require_node.createNodePinner({
+			verifyAddress: require_url.assertPublicAddress,
+			undici: await import("undici")
+		});
+		default: return null;
+	}
+}
+//#endregion
+Object.defineProperty(exports, "createBunPinner", {
+	enumerable: true,
+	get: function() {
+		return createBunPinner;
+	}
+});
+Object.defineProperty(exports, "detectRuntime", {
+	enumerable: true,
+	get: function() {
+		return detectRuntime;
+	}
+});
+Object.defineProperty(exports, "getRuntimePinner", {
+	enumerable: true,
+	get: function() {
+		return getRuntimePinner;
+	}
+});

package/dist/tests/pinners-zSofbiy2.mjs

@@ -0,0 +1,203 @@
+import { n as redeemPinGrant } from "./pin-grant-H5XhM1Xs.mjs";
+import { i as assertPublicAddress } from "./url-COj5Q8mb.mjs";
+import { t as createNodePinner } from "./node-Cg4pRuYy.mjs";
+import { getLogger } from "@logtape/logtape";
+import { isIP } from "node:net";
+//#region src/pinners/bun.ts
+const logger = getLogger([
+	"fedify",
+	"runtime",
+	"fetch"
+]);
+/**
+* The first Bun version that honors `proxy: false` when proxy environment
+* variables are set at startup.  Earlier versions send pinned requests
+* through the proxy, with the validated IP address as the target.
+*/
+const PROXY_FALSE_MIN_VERSION = "1.4.3";
+const PROXY_VARIABLES = [
+	"HTTP_PROXY",
+	"http_proxy",
+	"HTTPS_PROXY",
+	"https_proxy",
+	"ALL_PROXY",
+	"all_proxy"
+];
+const FALLBACK_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ConnectionRefused",
+	"ECONNREFUSED",
+	"EHOSTUNREACH",
+	"ENETUNREACH",
+	"ETIMEDOUT"
+]);
+/**
+* Bun versions before 1.3.11 verify the server certificate against the `Host`
+* header, including a non-default port, instead of `tls.serverName`, so
+* pinned requests to HTTPS servers on non-default ports always fail the check
+* there.  A custom `checkServerIdentity` cannot stand in for it: these
+* versions send the whole request before a failing custom check aborts it
+* (and 1.3.10 even reuses the connection for the next request), so such
+* requests are refused instead.
+*/
+const HOST_HEADER_IDENTITY_RANGE = "<1.3.11";
+/**
+* Creates a pinner for Bun.  Every request is sent to an IP literal URL with
+* the original `Host` header, `tls.serverName` set to the original hostname
+* (so that the certificate is still verified against it), and `proxy: false`.
+*
+* GET and HEAD requests fall back to the next address on transport errors
+* raised before a response arrives.  Other methods use only the first
+* address, since a transport error does not guarantee that the request did
+* not reach the server, and retrying it could deliver an activity twice.
+* Together with the transport retries of `doubleKnock()`, a GET request is
+* attempted at most twice per address.  Note that Bun 1.4 also reports
+* a connection reset after the request was sent as a `TypeError`, so GET and
+* HEAD requests may be repeated against the next address in that case, which
+* is acceptable for these idempotent methods.
+*
+* Bun versions before 1.3.11 verify certificates against the `Host` header,
+* which includes a non-default port, and cannot safely check them against
+* the original hostname in any other way, so requests to HTTPS servers on
+* non-default ports fail there with a `TypeError` before connecting.
+*
+* Bun versions before 1.4.3 ignore `proxy: false` when proxy environment
+* variables are set, so requests go through the proxy with the validated IP
+* address as the target.  In that case a warning is logged once.
+* @param options The pinner options.
+* @returns The pinner.
+*/
+function createBunPinner({ verifyAddress }) {
+	let proxyWarningPending = ignoresProxyFalse() && hasProxyVariables();
+	return {
+		supports(url) {
+			return url.protocol === "http:" || url.protocol === "https:";
+		},
+		async fetch(grant, request, signal) {
+			const url = new URL(request.url);
+			const { hostname, addresses } = redeemPinGrant(grant, url);
+			if (proxyWarningPending) {
+				proxyWarningPending = false;
+				logger.warn("Bun {version} ignores proxy: false while proxy environment variables are set, so outbound requests go through the proxy instead of connecting directly to the validated addresses.  Upgrade to Bun {minVersion} or later, or unset the proxy environment variables; see {url}.", {
+					version: getBun()?.version,
+					minVersion: PROXY_FALSE_MIN_VERSION,
+					url: "https://fedify.dev/manual/deploy#bun-behind-an-http-proxy"
+				});
+			}
+			const fallback = request.method === "GET" || request.method === "HEAD";
+			const candidates = fallback ? addresses : addresses.slice(0, 1);
+			const body = request.body == null ? null : await request.arrayBuffer();
+			let lastError = /* @__PURE__ */ new TypeError(`No address to connect to for ${url.host}.`);
+			for (const address of candidates) {
+				throwIfAborted(signal, request.signal);
+				verifyAddress(address);
+				const headers = new Headers(request.headers);
+				headers.set("Host", url.host);
+				const init = {
+					method: request.method,
+					headers,
+					body,
+					redirect: "manual",
+					signal: signal == null || signal === request.signal ? request.signal : anySignal(signal, request.signal),
+					proxy: false
+				};
+				if (url.protocol === "https:") init.tls = getTlsOptions(url, hostname);
+				try {
+					return await fetch(toAddressUrl(url, address), init);
+				} catch (error) {
+					throwIfAborted(signal, request.signal);
+					if (!fallback || !isFallbackError(error)) throw error;
+					lastError = error;
+				}
+			}
+			throw lastError;
+		},
+		release() {}
+	};
+}
+function getTlsOptions(url, hostname) {
+	const bun = getBun();
+	if (url.port !== "" && bun != null && bun.semver.satisfies(bun.version, HOST_HEADER_IDENTITY_RANGE)) throw new TypeError(`Bun ${bun.version} cannot verify the certificate of ${url.host} when connecting to a validated address; upgrade to Bun 1.3.11 or later to fetch from HTTPS servers on non-default ports.`);
+	return isIP(hostname) === 0 ? { serverName: hostname } : {};
+}
+/**
+* Combines two signals without `AbortSignal.any()`, which Bun 1.1.0 lacks.
+*/
+function anySignal(a, b) {
+	if (a.aborted) return a;
+	if (b.aborted) return b;
+	const controller = new AbortController();
+	const abort = (event) => {
+		controller.abort(event.target.reason);
+		a.removeEventListener("abort", abort);
+		b.removeEventListener("abort", abort);
+	};
+	a.addEventListener("abort", abort);
+	b.addEventListener("abort", abort);
+	return controller.signal;
+}
+function toAddressUrl(url, address) {
+	const result = new URL(url);
+	result.hostname = address.family === 6 ? `[${address.address}]` : address.address;
+	return result;
+}
+function isFallbackError(error) {
+	if (error instanceof Error && error.name === "AbortError") return false;
+	if (error instanceof TypeError) return true;
+	const code = error?.code;
+	return typeof code === "string" && FALLBACK_ERROR_CODES.has(code);
+}
+function throwIfAborted(...signals) {
+	for (const signal of signals) signal?.throwIfAborted();
+}
+function getBun() {
+	return globalThis.Bun;
+}
+function ignoresProxyFalse() {
+	const bun = getBun();
+	if (bun == null) return false;
+	return !bun.semver.satisfies(bun.version, `>=${PROXY_FALSE_MIN_VERSION}`);
+}
+function hasProxyVariables() {
+	const env = globalThis.process?.env;
+	if (env == null) return false;
+	return PROXY_VARIABLES.some((name) => (env[name] ?? "") !== "");
+}
+//#endregion
+//#region src/pinners/mod.ts
+/**
+* Detects the current runtime.  Cloudflare Workers is checked first, since
+* `process` can exist there with `nodejs_compat`, and Deno and Bun before
+* Node.js, since both provide `process.versions.node`.
+* @returns The current runtime.
+*/
+function detectRuntime() {
+	const g = globalThis;
+	if (g.navigator?.userAgent === "Cloudflare-Workers") return "cfworkers";
+	if ("Deno" in globalThis) return "deno";
+	if ("Bun" in globalThis) return "bun";
+	if (g.process?.versions?.node != null) return "node";
+	return "other";
+}
+let runtimePinner;
+/**
+* Gets the production pinner of the current runtime, which rejects
+* non-public addresses right before connecting.  Deno and Cloudflare Workers
+* have no pinner.
+* @returns The pinner, or `null` if the runtime has none.
+*/
+function getRuntimePinner() {
+	runtimePinner ??= createRuntimePinner(detectRuntime());
+	return runtimePinner;
+}
+async function createRuntimePinner(runtime) {
+	switch (runtime) {
+		case "bun": return createBunPinner({ verifyAddress: assertPublicAddress });
+		case "node": return createNodePinner({
+			verifyAddress: assertPublicAddress,
+			undici: await import("undici")
+		});
+		default: return null;
+	}
+}
+//#endregion
+export { getRuntimePinner as n, createBunPinner as r, detectRuntime as t };